J-Web :

1. Go to Configuration >Security > Policy Elements.
2. To add an address book entry for each zone, click on Address Books .
3. Click on the zone for which you would like to add an address book entry (example: zone trust ).
4. If address book entry required does not exist, then click Add... .
5. In the Address Name field specify a name (example: local-net ). 
   
   Note: The name must be a string beginning with a letter and consisting of letters, numbers, dashes and underscores.
6. In IP Address/Prefix , enter the IP address/subnet mask (example: 192.168.10.0/24 ).

   or

   in DNS Name , specify a fully qualified domain name. 
   
   Note: The J Series or SRX Series device must have a working DNS server configured to resolve the domain name.
7. Click OK .
8. Repeat steps 3-7 for zone untrust , Address Book entry remote-net . Click OK again to return to the Security Policies screen.

   For more information, refer to Configuring Address Books and Address Sets .

CLI:

root@SiteA#set security zones security-zone trust address-book address local-net 192.168.10.0/24
root@siteA#set security zones security-zone untrust address-book address remote-net 192.168.20.0/24


J-Web:

1. From Configuration > Security > Policy Elements  screen, click on Applications .
2. Select Custom-Applications tab.
3. Click Add...
4. Specify Application Name (example: tcp1500 ), then click (plus box) for Configure top level options .
5. Click on Match IP protocol , pull down, and choose <scode> tcp .
6. Enter 1500 in the free-form field for Destination port (not the pull-down field). Click OK . 
   
   Note: Since the application can use any source port, it is not necessary to also specify a source port for the application.
7. Click OK again to return to the Security Policies screen.

For more information refer to Understanding Custom Policy Applications and  Adding and Modifying Custom Policy Applications.

CLI:

root@SiteA#set applications application tcp1500 protocol tcp
root@SiteA#set applications application tcp1500 destination-port 1500

Note: If allowing all applications to traverse the Policy, then no custom application is needed since the pre-defined application “any” already exists, which allows all ports.

J-Web :

1. From Configuration > Security > Policy screen, click Apply Policy .
2. In Zone Direction , select From Zone trust and To Zone untrust.
3. Click Add a Policy .
4. Specify Policy Name (example: policy-tr-unt ), then click (plus box) for Match Criteria .
5. Select Source Address Book local-net object on the right side and click (left arrow) to add to the Matched list.
6. Select Destination Address Book remote-net object and click (left arrow) to add to the Matched list.
7. Select Application tcp1500 and click (left arrow) to add to the Matched list. 
8. For Policy Action , select Permit from the pull-down menu.
9. Click OK to commit changes.  Then click OK again to return to main policy configuration screen.

CLI:

root@SiteA#set security policies from-zone trust to-zone untrust policy policy-tr-unt match source-address local-net

root@SiteA#set security policies from-zone trust to-zone untrust policy policy-tr-unt match destination-address remote-net

root@SiteA#set security policies from-zone trust to-zone untrust policy policy-tr-unt match application tcp1500

root@SiteA#set security policies from-zone trust to-zone untrust policy policy-tr-unt then permit


The ordering of policies is important.  J Series or SRX Series devices will perform policy lookup from top to bottom until a match is found.  At that point no further policy lookup occurs.  Therefore if a deny all policy exists, then be sure that the policy created is above the deny all policy.  If not, then the policy will never be reached.  To re-arrange policy order, use the Move up or down option in the Security Policies screen in J-Web or the insert command in CLI.  For more information, consult KB10120 - How to change the order of the policies on a J Series or SRX Series device [juniper.net] .

Here are two custom applications created for TCP ports 5000 and 5001:

applications {
    application tcp_port_5000 {
        protocol tcp;
        destination-port 5000;
    }
    application tcp_port_5001 {
        protocol tcp;
        destination-port 5001;
    }
}

Here are two security policies using the custom applications:

[security policies]
from-zone inside to-zone outside {
    policy telnet_100 {
        match {
            source-address any;
            destination-address host_public;
            application tcp_port_5000;
        }
        then {
            permit
        }
    }
    policy telnet_101 {
        match {
            source-address any;
            destination-address host_public;
            application tcp_port_5001;
        }
        then {
            permit
        }
    }
}